Skip to main content
CVE-2025-13012VulnerabilityPublished Updated

Red Hat Security Advisory: firefox security update

Affects Red Hat firefoxSource GCVE Database

0

Mentioned vulnerabilities

Authoritative record:CVE-2025-13012· High 7.5

Not known to be exploited · CVSS 7.5 High.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score
7.5High
How severe the flaw is on the 0–10 CVSS scale.
EPSS
0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 11 Nov 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Affected software

ProductAffectedFixed in
Red Hatredhat/firefoxpkg:rpm/redhat/firefoxOther threatsAffected
  • =140.5.0-1.el8_8
  • =140.5.0-1.el8_8
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released an official security update for Firefox version 140.5.0-1.el8_8 addressing all listed vulnerabilities. Users and administrators should apply this update promptly using the standard Red Hat update mechanisms as detailed in the advisory (https://access.redhat.com/articles/11258). Since this is a traditional software package and not a cloud service, remediation requires manual update by the system administrators. No additional mitigations are specified beyond applying the update.

Description

Multiple security vulnerabilities have been identified and addressed in Mozilla Firefox as distributed by Red Hat Enterprise Linux 8.8. These include issues such as use-after-free, race conditions, mitigation bypasses, same-origin policy bypasses, and spoofing vulnerabilities affecting various components like DOM, Audio/Video, WebAssembly, WebRTC, Graphics, and Notifications. Red Hat has issued an important security update to fix these issues in Firefox version 140.5.0-1.el8_8. The update is available for several Red Hat Enterprise Linux 8.8 variants including x86_64 and ppc64le architectures.

References

Community reviews

Loading reviews…